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CLAIMS 

1. A data processing method including receiving input data 
containing a plurality of instruction codes, and judging whether or 
not a process executed based on the instruction codes contained in 
the received data is a malicious process, said method being 
characterized by comprising: 

retrieving an instruction code related to a branch instruction 
from the data; storing a branch origin address associated with the 
retrieved instruction code and a branch destination address 
associated with a branch destination of the instruction code; judging 
whether or not an instruction code for calling an instruction code 
group for executing a predetermined process is associated with the 
branch destination address; storing a call destination address of the 
instruction code if the instruction code is associated with the branch 
destination address; and judging whether or not the stored call 
destination address is between the branch origin address and the 
branch destination address. 

2. A data processor including means for receiving input data 
containing a plurality of instruction codes, for judging whether or 
not a process executed based on the instruction codes contained in 
the received data is a malicious process, said data processor being 
characterized by comprising: 

means for retrieving an instruction code related to a branch 
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instruction from the data! means for storing a branch origin address 
associated with the retrieved instruction code and a branch 
destination address associated with a branch destination of the 
instruction code; means for judging whether or not an instruction 
code for calling an instruction code group for executing a 
predetermined process is associated with the branch destination 
address; storing a call destination address of the instruction code if 
the instruction code is associated with the branch destination 
address; means forjudging whether or not the stored call 
destination address is between the branch origin address and the 
branch destination address; and means for outputting information 
indicating that the data is data for executing a malicious process if 
the call destination address is between the branch origin address 
and the branch destination address. 

3. The data processor as set forth in claim 2, characterized 
by further comprising means for judging whether or not a 
predetermined character string is associated with a return address 
of the instruction code group, wherein if the character string is 
associated with the return address, the information indicating that 
the data is data for executing a malicious process is outputted. 

4. A data processor including means for receiving input data 
containing a plurality of instruction codes, for judging whether or 
not a process executed based on the instruction codes contained in 
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the data received by the means is a malicious process, said data 
processor being characterized by comprising*. 

means for retrieving an instruction code for calling an 
instruction code group for executing a predetermined process from 
the data; means for judging whether or not a predetermined 
character string is associated with a return address of the 
instruction code group; and means for outputting information 
indicating that the data is data for executing a malicious process if 
the character string is associated with the return address. 

5. A data processor including means for receiving input data 
containing a plurality of instruction codes, for judging whether or 
not a process executed based on the instruction codes contained in 
the data received by the means is a malicious process, said data 
processor being characterized by comprising" 

means for retrieving an instruction code for calling an 
instruction code group for executing a predetermined process from 
the data; means for judging whether or not an instruction code for 
obtaining a return address of the instruction code group is 
contained in the instruction code group if the instruction code is 
retrieved; and means for outputting information indicating that the 
data is data for executing a malicious process if the instruction code 
is contained in the instruction code group. 



6. A computer program including a step of causing a 
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computer to judge whether or not a process executed based on input 
data containing a plurality of instruction codes is a malicious 
process, characterized by comprising: 

a step of causing the computer to retrieve an instruction code 
related to a branch instruction from the data; a step of causing the 
computer to store a branch origin address associated with the 
retrieved instruction code and a branch destination address 
associated with a branch destination of the instruction code; a step 
of causing the computer to judge whether or not an instruction code 
for calling an instruction code group for executing a predetermined 
process is associated with the branch destination address; a step of 
causing the computer to store a call destination address of the 
instruction code if the instruction code is associated with the branch 
destination address; and a step of causing the computer to judge 
whether or not the stored call destination address is between the 
branch origin address and the branch destination address. 

7. A computer-readable memory product storing a computer 
program including a step of causing a computer to judge whether or 
not a process executed based on input data containing a plurality of 
instruction codes is a malicious process, characterized in that the 
stored computer program comprises - 

a step of causing the computer to retrieve an instruction code 
related to a branch instruction from the data; a step of causing the 
computer to store a branch origin address associated with the 
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retrieved instruction code and a branch destination address 
associated with a branch destination of the instruction code; a step 
of causing the computer to judge whether or not an instruction code 
for calling an instruction code group for executing a predetermined 
process is associated with the branch destination address; a step of 
causing the computer to store a call destination address of the 
instruction code if the instruction code is associated with the branch 
destination address; and a step of causing the computer to judge 
whether or not the stored call destination address is between the 
branch origin address and the branch destination address. 



